SM2 is China's 256-bit elliptic curve, used with the SM2 signature and key-exchange algorithms and the SM3 hash.
SM2 is a short Weierstrass curve y² = x³ + ax + b over a 256-bit prime field with a 256-bit prime-order subgroup and cofactor 1; its estimated security level is 128 bits. Status: secure, but regional or niche.
The curve is y² = x³ − 3x + b over p = 2^256 − 2^224 − 2^96 + 2^64 − 1, published by China's Office of State Commercial Cryptography Administration (OSCCA) in 2010 and standardised as GB/T 32918. OpenSSL calls it SM2 and TLS lists it as curveSM2.
The SM2 signature algorithm is not ECDSA: the signer first hashes a user identifier and the public key into a value Z_A that is prepended to the message, and the signature equation differs, so an SM2 key cannot be checked with an ECDSA verifier. RFC 8998 brings SM2 and SM3 to TLS 1.3 (group 41, signature scheme sm2sig_sm3), and RFC 9563 to DNSSEC as algorithm 17.